{"record":{"id":"9ceae0e0832350a1","repo":"rustfs/rustfs","slug":"invalid-x-amz-content-sha256-header-value-err","errorCode":null,"errorMessage":"invalid X-Amz-Content-Sha256 header value: {err}","messagePattern":"invalid X-Amz-Content-Sha256 header value: (.+?)","errorType":"validation","errorClass":"std::io::Error","httpStatus":null,"severity":"warning","filePath":"crates/ecstore/src/client/bucket_cache.rs","lineNumber":188,"sourceCode":"            signer_type = SignatureType::SignatureAnonymous\n        }\n\n        if signer_type == SignatureType::SignatureAnonymous {\n            return Ok(req);\n        }\n\n        if signer_type == SignatureType::SignatureV2 {\n            let req = rustfs_signer::sign_v2(req, 0, &access_key_id, &secret_access_key, is_virtual_style);\n            return Ok(req);\n        }\n\n        let mut content_sha256 = EMPTY_STRING_SHA256_HASH.to_string();\n        if self.secure {\n            content_sha256 = UNSIGNED_PAYLOAD.to_string();\n        }\n\n        let content_sha256_value = content_sha256.parse().map_err(|err| {\n            std::io::Error::new(\n                std::io::ErrorKind::InvalidInput,\n                format!(\"invalid X-Amz-Content-Sha256 header value: {err}\"),\n            )\n        })?;\n        req.headers_mut().insert(\"X-Amz-Content-Sha256\", content_sha256_value);\n        let req = rustfs_signer::try_sign_v4(req, 0, &access_key_id, &secret_access_key, &session_token, \"us-east-1\")\n            .map_err(|err| signer_error_to_io_error(\"failed to sign bucket location request\", err))?;\n        Ok(req)\n    }\n}\n\nasync fn process_bucket_location_response(\n    mut resp: http::Response<Incoming>,\n    bucket_name: &str,\n    tier_type: &str,\n) -> Result<String, std::io::Error> {\n    //if resp != nil {\n    if resp.status() != StatusCode::OK {","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/rustfs/rustfs/blob/9e6e02ea09c86bedf44c7bd64a74ea02a0cff1de/crates/ecstore/src/client/bucket_cache.rs#L170-L206","documentation":"Before signing a bucket-location request with SigV4, the client parses its own X-Amz-Content-Sha256 constant (the empty-body SHA-256 hex digest, or the literal UNSIGNED-PAYLOAD when secure) into a HeaderValue; this error fires if that constant is not a valid header value. In unmodified builds both constants are well-formed ASCII, so hitting this indicates corrupted constants or a modified fork of rustfs-utils/signer.","triggerScenarios":"Executing the SigV4 bucket-location path while EMPTY_STRING_SHA256_HASH or UNSIGNED_PAYLOAD has been changed to a value containing non-ASCII or illegal bytes - i.e., a patched or corrupted dependency, not any runtime input.","commonSituations":"Custom forks that patched hash constants; build-environment drift producing a modified vendored rustfs-utils; essentially never observed in stock builds, which is why the error is defensive.","solutions":["Treat it as a source/build integrity problem: diff your rustfs-utils and rustfs-signer crates against upstream releases.","Restore EMPTY_STRING_SHA256_HASH to the 64-character hex of the empty input and UNSIGNED_PAYLOAD to the literal string UNSIGNED-PAYLOAD.","If it reproduces with pristine dependencies, report it upstream with the constant values observed in your build."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match build_and_sign_location_request(...) {\n    Ok(req) => Ok(req),\n    Err(e) if e.kind() == std::io::ErrorKind::InvalidInput => {\n        tracing::error!(event = \"signing_constant_invalid\", \"X-Amz-Content-Sha256 constant is not a valid header; treat as build integrity failure\");\n        Err(e)\n    }\n    Err(e) => Err(e),\n}","preventionTips":["Pin rustfs-utils and rustfs-signer to released versions in Cargo.lock.","In forks, add a unit test asserting EMPTY_STRING_SHA256_HASH parses as a HeaderValue and equals the empty-input SHA-256.","Treat any occurrence as a compromised build until proven otherwise."],"tags":["rust","s3","signing","invariant","defensive-code"],"backgroundTag":"invalid-header-value","analyzedSha":"9e6e02ea09c86bedf44c7bd64a74ea02a0cff1de","analyzedAt":"2026-08-16T20:34:17.560Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}